CVE-2026-70573

CVE-2026-70573 is a heap-based buffer overflow (arising from improper input validation, CWE-20/CWE-122) in the Windows Biometric Service, the Windows component that handles Windows Hello and fingerprint/face authentication. It is triggered when the service processes crafted input from a local, already-authenticated user with low privileges. A successful exploit allows the attacker to elevate privileges on the local machine, gaining high-level (typically SYSTEM) access to the confidentiality, integrity, and availability of that host. Any Windows system running the Biometric Service is affected — most relevantly desktops and laptops with biometric hardware such as fingerprint readers or IR cameras. There is no known public proof-of-concept, it is not in CISA KEV, and EPSS puts 30-day exploitation probability at a low 0.3% (19th percentile), so no active exploitation is currently known.

What to do: Patch via the current Microsoft cumulative/security update; the data does not list specific fixed builds, so map CVE-2026-70573 against the affected versions in the official MSRC advisory before deploying. Prioritize fleet assets where Windows Hello or third-party biometric logons are enabled, and verify installation of the fix with your patch-management tooling. As interim risk reduction, limit creation of low-privilege local accounts on shared endpoints and monitor the advisory for any change in exploitation status.